Data agreements
Data handling agreement, global
In the libraryThe door has this paper. Type its name at the composer. It offers to start from it.
The same job as the US data paper, written for work that crosses borders — the version a European customer usually asks for before they will sign anything else. It sits alongside a services agreement rather than replacing one. Beyond the usual scope and security terms it deals with where data goes, which transfer mechanism is relied on, and what each side does when a person asks about their own information.
- Printed on the page as
- Data Processing Addendum (Global)
- Where it can live
- Any of the 184 governing laws
Who uses one
- Suppliers with customers in Europe, the United Kingdom or other regions with transfer rules.
- Companies whose infrastructure or staff sit in a different country from their customers.
- Businesses asked for a processor agreement as part of a procurement process.
What you are deciding
- What categories of personal data are involved, and whose
- The purpose the data may be used for
- Where the data goes, and which transfer route is relied on
- Which subprocessors are approved, and how new ones are notified
- What security measures apply, described concretely
- How requests from individuals are handled
- Incident notification, and how quickly
- Retention, deletion and audit at the end
Blanks you leave stay blank and wait in the room. Nothing is filled in from a guess.
The sections a draft usually has
- 1The agreement it attaches to
- 2Definitions and roles
- 3Subject matter and duration
- 4Instructions and permitted purpose
- 5Subprocessors
- 6International transfers
- 7Security measures
- 8Assistance with individual requests
- 9Incident notification
- 10Return, deletion and audit
A general outline, not a required one. What turns up in a draft follows what you described. A contract is written in the order a contract is read.
What people call it
Type any of these at the door. It offers this paper. The matching happens in your own browser, on a wordlist you could read. No model runs before you sign in.
- global dpa
- gdpr dpa
- eu dpa
- gdpr data processing agreement
- international data processing addendum
- global data processing addendum
Questions people ask
- What is the difference between a controller and a processor?
- In several frameworks, the controller decides why and how data is used and the processor acts on instructions. The labels change what each side has to do, which is why the roles section comes early.
- Why do international transfers get their own section?
- Because moving personal data between countries is regulated in a number of regions, and the route relied on — a standard set of clauses, an adequacy finding, or something else — has to be named.
- Are subprocessors normally listed?
- Commonly there is a list plus a route for adding to it with notice and a chance to object. Customers usually care as much about the notice as about the list itself.
General answers about the document. Not advice about your situation. Not written about any one country.
Where it lives
A contract names the legal system it is governed by. That is a separate decision from which paper it is. You pick it at the door, from any of the 184 units in Governing law, including England and Wales, Delaware, California and New York.
Say what you agreed in one sentence. When what you describe is data handling agreement, global, the door offers this paper. One press takes it. One press refuses it.
Start it at the door →Related kinds